Adding to what has already been said - I would advise _against_ using those fields. Their contents may be misleading, especially if you ingest data from different timezones and searching by them can be additionally skewed vs. what you expect if you're yet in another timezone. Quoting the docs: [...] If an event has a date_* field, it represents the value of time/date directly from the event itself. If you have specified any timezone conversions or changed the value of the time/date at indexing or input time (for example, by setting the timestamp to be the time at index or input time), these fields will not represent that. [...] ... View more

Hi Giuseppe thank you for your help it worked 🙂 ... View more

Hi @Eyal, good for you, see next time! let me know if I can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Actually, it's not a question about _how_ to search in Splunk but rather _what_ to search for. And here you need a windows guy who will tell you what kind of events you need in the first place. ... View more